Kali Linux渗透测试之被动信息收集（一）——nslookup、dig、DNS区域传输，DNS字典爆破，DNS注册信息

最新推荐文章于 2023-03-19 17:45:00 发布

weixin_45116657

最新推荐文章于 2023-03-19 17:45:00 发布

阅读量1.7k

点赞数 1

本文链接：https://blog.csdn.net/weixin_45116657/article/details/99344864

版权

一、被动信息收集

1、被动信息搜集

公开渠道可获得信息；
与目标系统不产生直接交互；
尽量避免留下痕迹；

2、搜集的内容

IP地址段，域名信息，邮件地址，文档图片数据，公司地址，公司组织架构、联系电话/传真号码、人员姓名/职务，公开的商业信息等；

二、信息收集——DNS

1、DNS解析流程：

本机的网络配置中会指定一个本地DNS服务器，当发起网络请求时，主机先问本地先问本地DNS服务器，DNS服务器返回对应域名的IP地址。

在这里插入图片描述

以请求www.baidu.com为例：

本地的DNS服务器以开始是不知道ww.baidu.com的IP地址的，它会去问根域服务器（即，域）；
根域服务器只解析13个根域名服务器，所以不会直接返回www.baidu.com的IP地址，而是返回.com域的域名服务器的地址，让贝蒂域名服务器去访问.com服务器；
本地DNS服务器去访问.com服务器，但是.com服务器也不知道www.baidu.com的IP地址，但是会返回一个存储了baidu.com这个域名服务器的地址，让本地DNS服务器去访问baidu.com域名服务器；
本地服务器就去问记录了baidu.com域名服务器，问它知不知道www.baidu.com对应的ip地址是多少。这个服务器一查，确实有一个域名是baidu.com的主机进行了A记录解析(即www.baidu.com)，对应着一个ip地址，它会将ip地址返回给本地DNS服务器；
本地服务器拿到这个ip，先在本地缓存一份，然后再把www.baidu.com对应的ip地址返回给请求的主机；
这时候，当有其他主机问本地DNS服务器www.baidu.com对应的ip是多少时，本地DNS服务器发现自己的缓存中有这条记录，就会直接返回www.baidu.com的ip。
主机和本地服务器之间的查询称为递归查询，而本地服务器与各种域名服务器之间的查询称为迭代查询。

2、DNS的域名记录；

域名申请后，然后进行域名的用途进行域名管理，设置相应的域名记录。在域名解析时会调用域名服务器，根据相对应的域名记录，从而判断用哪个dns服务器进行解析。
当你购买域名之后，这个域名的DNS记录都是在域名使用的NS服务器上面设置的，而NS服务器是可以根据需要改动的，比如我在namesilo注册了域名，但是我的网站是面向国内浏览者的，为了提高访问速度我把NS服务器放在了DNSPOD上面。那么涉及到网站A记录，cname记录和MX记录等添加、修改、删除都需要在DNSPOD上面完成，也就是说NS服务器在哪里，就去哪里设置DNS记录。

A记录：主机记录，是使用最广泛的DNS记录；（比如说，www.baidu.com可以创造多个A记录，对应多台物理服务器的IP地址，可以实现基本的流量均衡！！！）
NS记录：也称为域名服务器地址，用于说明这个区域有哪些DNS服务器承担解析任务；
SOA记录：起始授权机构记录，SOA记录说明了在众多NS记录里面那一台才是数DNS服务器；
MX记录：邮件交换记录，MX记录是不可或缺的，比如：A用户向B用户发送一封邮件，那么它需要向DNS服务器查询B的MX记录，DNS定位了B的MX记录后反馈给A用户，然后A用户把邮件投递给B用户的MX记录服务器里面；
Cname记录：：别名记录；
PTR记录：反向地址解析记录，作用是把IP地址解析为域名。DNS的反向区域负责从IP地址到域名的解析，因此如果要创建PTR记录，必须反向区域中创建；

3、DNS信息收集——nslookup

nslookup和dig都是非常有用的网络命令，简单而言，就是查dns信息用的；
本地的DNS配置文件存放在是：/etc/resolv.conf ；
交互式：直接输入nslookup命令，不加任何参数，则直接进入交互模式，此时nslookup会连接到默认的域名服务器（即/etc/resolv.conf的第一个dns地址）；
非交互式：如果你直接在nslookup命令后加上所要查询的IP或主机名，那么就进入了非交互模式。当然，这个时候你也可以在第二个参数位置设置所要连接的域名服务器。

3.1> 非交互式

root@kali:~# nslookup sina.com
Server:		192.168.85.2
Address:	192.168.85.2#53

Non-authoritative answer:
Name:	sina.com
Address: 66.102.251.33

root@kali:~# nslookup -type=mx sina.com
Server:		192.168.85.2
Address:	192.168.85.2#53

Non-authoritative answer:                                       #10表示优先级，相比5优先
sina.com	mail exchanger = 10 freemx3.sinamail.sina.com.cn.
sina.com	mail exchanger = 10 freemx2.sinamail.sina.com.cn.
sina.com	mail exchanger = 5 freemx1.sinamail.sina.com.cn.

Authoritative answers can be found from:

3.2> 交互式

root@kali:~# nslookup
> server                                                #本地DNS
Default server: 192.168.85.2
Address: 192.168.85.2#53
> sina.com
Server:		192.168.85.2
Address:	192.168.85.2#53

Non-authoritative answer:
Name:	sina.com
Address: 66.102.251.33
> set type=mx
> sina.com
Server:		192.168.85.2
Address:	192.168.85.2#53

Non-authoritative answer:
sina.com	mail exchanger = 5 freemx1.sinamail.sina.com.cn.
sina.com	mail exchanger = 10 freemx2.sinamail.sina.com.cn.
sina.com	mail exchanger = 10 freemx3.sinamail.sina.com.cn.

Authoritative answers can be found from:

注意：一般情况下，采用不同的DNS服务器得到的结果是不一样的，因为现在都采用智能DNS，根据终端用户的地址返回的服务器IP，一提升访问速度。

4、DNS信息收集——Dig

4.1> Dig信息收集

格式：dig @指定DNS服务器要收集的域名

dig @8.8.8.8 sina.com；

dig @8.8.8.8 sina.com any；

dig @8.8.8.8 sina.com mx；

root@kali:~# dig @8.8.8.8 sina.com

; <<>> DiG 9.11.5-P4-3-Debian <<>> @8.8.8.8 sina.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3615
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;sina.com.			IN	A

;; ANSWER SECTION:
sina.com.		59	IN	A	66.102.251.33            #这个是我们主要搜集的信息，即，sina.com的IP地址

;; Query time: 97 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: 一 8月 12 23:32:26 CST 2019
;; MSG SIZE  rcvd: 53
oot@kali:~# dig @8.8.8.8 sina.com any

; <<>> DiG 9.11.5-P4-3-Debian <<>> @8.8.8.8 sina.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35820
;; flags: qr rd ra; QUERY: 1, ANSWER: 14, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;sina.com.			IN	ANY

;; ANSWER SECTION:
sina.com.		59	IN	A	66.102.251.33
sina.com.		59	IN	TXT	"v=spf1 include:spf.sinamail.sina.com.cn -all"
sina.com.		299	IN	SOA	ns1.sina.com.cn. zhihao.staff.sina.com.cn. 2005042601 900 300 604800 300
sina.com.		21599	IN	NS	ns1.sina.com.
sina.com.		21599	IN	NS	ns3.sina.com.
sina.com.		21599	IN	NS	ns1.sina.com.cn.
sina.com.		21599	IN	NS	ns3.sina.com.cn.
sina.com.		21599	IN	NS	ns2.sina.com.cn.
sina.com.		21599	IN	NS	ns4.sina.com.
sina.com.		21599	IN	NS	ns4.sina.com.cn.
sina.com.		21599	IN	NS	ns2.sina.com.
sina.com.		59	IN	MX	5 freemx1.sinamail.sina.com.cn.
sina.com.		59	IN	MX	10 freemx2.sinamail.sina.com.cn.
sina.com.		59	IN	MX	10 freemx3.sinamail.sina.com.cn.

;; Query time: 101 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: 一 8月 12 23:32:59 CST 2019
;; MSG SIZE  rcvd: 395

root@kali:~# dig @8.8.8.8 sina.com mx

; <<>> DiG 9.11.5-P4-3-Debian <<>> @8.8.8.8 sina.com mx
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22958
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;sina.com.			IN	MX

;; ANSWER SECTION:
sina.com.		59	IN	MX	10 freemx2.sinamail.sina.com.cn.
sina.com.		59	IN	MX	10 freemx3.sinamail.sina.com.cn.
sina.com.		59	IN	MX	5 freemx1.sinamail.sina.com.cn.

;; Query time: 100 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: 一 8月 12 23:35:56 CST 2019
;; MSG SIZE  rcvd: 129

4.2> 反向查询

格式：dig +noall +answer -x 8.8.8.8

#dig +noall（什么也不显示） +answer（只显示answer信息） -x（反向解析） IP地址

示例：dig +noall +answer -x 114.114.114.114

root@root:~# dig +noall +answer -x 8.8.8.8
8.8.8.8.in-addr.arpa.	5	IN	PTR	google-public-dns-a.google.com.
root@root:~# dig +noall +answer -x 114.114.114.114
114.114.114.114.in-addr.arpa. 5	IN	PTR	public1.114dns.com.

4.3> bind版本信息

dig +noall +answer txt chaos VERSION.BIND @ns4.sina.com #chaos类中的txt记录

dig +noall +answer txt chaos VERSION.BIND @ns2.sina.com #VERSION.BIND是搜集域名服务器的版本信息；

oot@kali:~# dig +noall +answer txt chaos VERSION.BIND @ns4.sina.com
VERSION.BIND.		0	CH	TXT	"  "
root@kali:~# dig +noall +answer txt chaos VERSION.BIND @ns2.baidu.com
VERSION.BIND.		0	CH	TXT	"baidu dns"

4.4> DNS追踪

dig +trace www.sina.com

#DNS追踪：根域——.com域——sina.com域——www.sina.com

root@root:~# dig +trace www.sina.com
 
; <<>> DiG 9.11.3-1-Debian <<>> +trace www.sina.com
;; global options: +cmd
.			5	IN	NS	j.root-servers.net.
.			5	IN	NS	m.root-servers.net.
.			5	IN	NS	c.root-servers.net.
.			5	IN	NS	l.root-servers.net.
.			5	IN	NS	f.root-servers.net.
.			5	IN	NS	b.root-servers.net.
.			5	IN	NS	h.root-servers.net.
.			5	IN	NS	a.root-servers.net.
.			5	IN	NS	g.root-servers.net.
.			5	IN	NS	k.root-servers.net.
.			5	IN	NS	e.root-servers.net.
.			5	IN	NS	d.root-servers.net.
.			5	IN	NS	i.root-servers.net.
.			5	IN	RRSIG	NS 8 0 518400 20190418050000 20190405040000 25266 . VNWzDcvX06igl5CFfUiI17m1zagzlUYd2+RSepxu/XU+4KXcPgCe0ZdT kUqePg9vudkrlyVutXe4kpv8WRuP30EKVDEt8kU0V+TxAfjUjYiR5lmd u8FuB+eIkbT5yT5NcS4xuY1W5nRdRTvTIgHUqWC2NZ2IrCVwlTcHLnra qbegu9rWlxrYh5kc6FS9/WLdCAHFxH+LIqqaPl7hHFA4PwJ0AgzYf4v2 Fz+SUX6te4AYdj/D3pBPnccoKYQp5gOinNHrYkxfDy3R6hVSpKq7d1bG ERheOLVqkD8vG9dAb21wu1vha+SBkVY9nRVm9A2ujdMEPA90zAUs0G4p 6RzW0A==
;; Received 525 bytes from 192.168.37.2#53(192.168.37.2) in 116 ms
 
com.			172800	IN	NS	l.gtld-servers.net.
com.			172800	IN	NS	i.gtld-servers.net.
com.			172800	IN	NS	k.gtld-servers.net.
com.			172800	IN	NS	d.gtld-servers.net.
com.			172800	IN	NS	g.gtld-servers.net.
com.			172800	IN	NS	h.gtld-servers.net.
com.			172800	IN	NS	a.gtld-servers.net.
com.			172800	IN	NS	c.gtld-servers.net.
com.			172800	IN	NS	j.gtld-servers.net.
com.			172800	IN	NS	b.gtld-servers.net.
com.			172800	IN	NS	e.gtld-servers.net.
com.			172800	IN	NS	m.gtld-servers.net.
com.			172800	IN	NS	f.gtld-servers.net.
com.			86400	IN	DS	30909 8 2 E2D3C916F6DEEAC73294E8268FB5885044A833FC5459588F4A9184CF C41A5766
com.			86400	IN	RRSIG	DS 8 1 86400 20190420050000 20190407040000 25266 . xJfyk0apzGEdqqnqJplDAclMAYiD4rWQJmaEXHa0k1NvKFHV40Yp+SEN 1o8bXA2KXDqdxRZjwr6YD79EOHYEXNIffuD3sUnINkej7+T/vMb2tY5t KmHtMVeMgxHGRW3G9MeCl9CVGAOsEiGg6olpongBPed8pnOiUmPNYJ5b AJng4pH8r4RDt1EMPnT6PKaLZ8eA0l+RxwAILBzE3LnMQmcInl2ou/Em Vsn4vVplISs7vsn5PvHTig0bZ4pehajnr0/HeSDqlkPJSPh0uscicrx1 8n0DWF01Erqh/FEWHj39Nz3QHclFZmzQOFIGexZph2Da0zxvYPhM8IZO WaK1qQ==
;; Received 1200 bytes from 199.9.14.201#53(b.root-servers.net) in 307 ms
 
sina.com.		172800	IN	NS	ns1.sina.com.cn.
sina.com.		172800	IN	NS	ns2.sina.com.cn.
sina.com.		172800	IN	NS	ns3.sina.com.cn.
sina.com.		172800	IN	NS	ns1.sina.com.
sina.com.		172800	IN	NS	ns2.sina.com.
sina.com.		172800	IN	NS	ns4.sina.com.
sina.com.		172800	IN	NS	ns3.sina.com.
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN NSEC3 1 1 0 - CK0Q1GIN43N1ARRC9OSM6QPQR81H5M9A  NS SOA RRSIG DNSKEY NSEC3PARAM
CK0POJMG874LJREF7EFN8430QVIT8BSM.com. 86400 IN RRSIG NSEC3 8 2 86400 20190413044428 20190406033428 16883 com. KDKyKhfEhyxmB3esZoOugsRqNEbqOD4m7st+H+2lroRIpaKyGflx2DPN yorfB62+ox6whk+X9/+fITemoMGaXd4O58PuvunOfVdKyVpkp/Lw2fqd X//PtaGqQ51ZSy6iGY7V945u+FDcDG8NFjBvhCABaSNIUKIct7lnYd+2 7v8=
TGAG8VMC6NS5VVK68CIGRJ6Q414N2KB2.com. 86400 IN NSEC3 1 1 0 - TGAINT5FJN61NLBMD25JONRMDSP6IECS  NS DS RRSIG
TGAG8VMC6NS5VVK68CIGRJ6Q414N2KB2.com. 86400 IN RRSIG NSEC3 8 2 86400 20190412070141 20190405055141 16883 com. LNdjTr/cbvHkj3SBeJalnT8Gr3MOHk8kvbWQd+DzjW3PkI2uG4v09Uvz FUQb0woExj+UcLU4Kh8zMFMzwqoObwu1SIqHMWxMxb/l3qf3apCxKRaP /ZsQ+Tr0STZh5D5ZVIX+XCcUmj8WksTbdOx5sMKNuz2m30d6pEi3rxOn iWw=
;; Received 727 bytes from 192.26.92.30#53(c.gtld-servers.net) in 246 ms
 
www.sina.com.		60	IN	CNAME	us.sina.com.cn.
us.sina.com.cn.		60	IN	CNAME	spool.grid.sinaedge.com.
;; Received 103 bytes from 123.125.29.99#53(ns3.sina.com.cn) in 81 ms

5、DNS区域传输

将一个区域文件复制到多个DNS服务器上的过程称为区域传送，这个功能能够完成DNS服务器之间的数据同步，一般只发生在DNS服务器之间。

如果DNS区域传输存在漏洞，我们就可以利用DNS区域传输来查看目标的记录，首先我们要知道一个域名服务器，因为域名服务器有所有的主机记录；采用***dig @域名服务器域名传输方法axfr***（AXFR——Request for full zone transfer（要求完整的区域转移））同步数据记录；

dig @ns1.sina.com sina.com axfr

host -T -l sina.com ns1.sina.com

root@kali:~# dig @ns1.sina.com sina.com axfr

; <<>> DiG 9.11.5-P4-3-Debian <<>> @ns1.sina.com sina.com axfr
; (1 server found)
;; global options: +cmd
; Transfer failed.
root@kali:~# host -T -l sina.com ns1.sina.com
Using domain server:
Name: ns1.sina.com
Address: 114.134.80.144#53
Aliases: 

Host sina.com not found: 5(REFUSED)
; Transfer failed.

6、DNS字典爆破

一般情况下，都不能直接与域名服务器进行同步。得到想要的主机记录，这个时候就可以使用DNS字典爆破，拿一个字典一个个的尝试，把对应域名的解析记录全部暴力尝试出来。

6.1> fierce

fierce工具主要是对子域名进行扫描和收集信息。使用fierce工具获得一个目标主机上所有IP地址和主机信息；

dpkg -L fierce#dpkg是进行包管理，可以搜集出系统中与fierce相关的文件

fierce -dnsserver 8.8.8.8 -dns sina.com.cn -wordlist /usr/share/fierce/hosts.txt
#-dnsserver指定DNS服务器，-dns指定要查询的域，-wordlist指定字典

root@kali:~# dpkg -L fierce
/.
/usr
/usr/bin
/usr/bin/fierce
/usr/share
/usr/share/doc
/usr/share/doc/fierce
/usr/share/doc/fierce/changelog.Debian.gz
/usr/share/doc/fierce/copyright
/usr/share/fierce
/usr/share/fierce/hosts.txt
root@kali:~# fierce -dnsserver 8.8.8.8 -dns sina.com.cn -wordlist /usr/share/fierce/hosts.txt
DNS Servers for sina.com.cn:
	ns3.sina.com.cn
	ns4.sina.com.cn
	ns2.sina.com.cn
	ns1.sina.com.cn

Trying zone transfer first...

Unsuccessful in zone transfer (it was worth a shot)
Okay, trying the good old fashioned way... brute force

Checking for wildcard DNS...
Nope. Good.
Now performing 2280 test(s)...
39.156.6.98	1.sina.com.cn
221.179.175.207	a.sina.com.cn
... ...

6.2> dnsenum
dpkg -L dnsenum
#查看系统中与dnsenum相关的文件

***dnsenum -f /usr/share/dnsenum/dns.txt -dnsserver 8.8.8.8 sina.com -o sina.xml ***
# -dnsserver指定DNS服务器 -f指定字典

root@root:~# dpkg -L dnsenum     #查询系统中与dnsenum相关的文件
/.
/usr
/usr/bin
/usr/bin/dnsenum
/usr/share
/usr/share/dnsenum
/usr/share/dnsenum/dns.txt
/usr/share/doc
/usr/share/doc/dnsenum
/usr/share/doc/dnsenum/README.md
/usr/share/doc/dnsenum/changelog.Debian.gz
/usr/share/doc/dnsenum/copyright
root@root:~# dnsenum -f /usr/share/dnsenum/dns.txt -dnsserver 8.8.8.8 sina.com -o sina.xml
Smartmatch is experimental at /usr/bin/dnsenum line 698.
Smartmatch is experimental at /usr/bin/dnsenum line 698.
dnsenum VERSION:1.2.4
 
-----   sina.com   -----
 
 
Host's addresses:
__________________
 
sina.com.                                4        IN    A        66.102.251.33
 
 
Name Servers:
______________
 
ns1.sina.com.cn.                         338      IN    A        202.106.184.166
ns3.sina.com.                            523      IN    A        180.149.138.199
ns2.sina.com.cn.                         2524     IN    A        180.149.138.199
ns4.sina.com.cn.                         162      IN    A        121.14.1.22
ns4.sina.com.                            1726     IN    A        123.125.29.99
ns2.sina.com.                            1670     IN    A        114.134.80.145
ns1.sina.com.                            1280     IN    A        114.134.80.144
ns3.sina.com.cn.                         2872     IN    A        123.125.29.99
 
 
Mail (MX) Servers:
___________________
 
freemx3.sinamail.sina.com.cn.            60       IN    A        39.156.6.104
freemx1.sinamail.sina.com.cn.            55       IN    A        39.156.6.104
freemx2.sinamail.sina.com.cn.            60       IN    A        121.14.32.117
 
 
Trying Zone Transfers and getting Bind Versions:
_________________________________________________
 
 
Trying Zone Transfer for sina.com on ns1.sina.com.cn ... 
AXFR record query failed: REFUSED
 
Trying Zone Transfer for sina.com on ns3.sina.com ... 
AXFR record query failed: REFUSED
 
Trying Zone Transfer for sina.com on ns2.sina.com.cn ... 
AXFR record query failed: REFUSED
 
Trying Zone Transfer for sina.com on ns4.sina.com.cn ... 
AXFR record query failed: REFUSED
 
Trying Zone Transfer for sina.com on ns4.sina.com ... 
AXFR record query failed: REFUSED
 
Trying Zone Transfer for sina.com on ns2.sina.com ... 
AXFR record query failed: REFUSED
 
Trying Zone Transfer for sina.com on ns1.sina.com ... 
AXFR record query failed: REFUSED
 
Trying Zone Transfer for sina.com on ns3.sina.com.cn ... 
AXFR record query failed: REFUSED
 
 
Brute forcing with /usr/share/dnsenum/dns.txt:
_______________________________________________
 
ads.sina.com.                            60       IN    CNAME    ww1.sinaimg.cn.w.alikunlun.com.
ww1.sinaimg.cn.w.alikunlun.com.          46       IN    A        111.19.237.233
ww1.sinaimg.cn.w.alikunlun.com.          46       IN    A        111.19.237.229
ww1.sinaimg.cn.w.alikunlun.com.          46       IN    A        111.19.237.230
ww1.sinaimg.cn.w.alikunlun.com.          46       IN    A        111.19.237.226
ww1.sinaimg.cn.w.alikunlun.com.          46       IN    A        111.19.237.227
ww1.sinaimg.cn.w.alikunlun.com.          46       IN    A        111.19.237.232
ww1.sinaimg.cn.w.alikunlun.com.          46       IN    A        111.19.237.228
ww1.sinaimg.cn.w.alikunlun.com.          46       IN    A        111.19.237.231
blog.sina.com.                           60       IN    CNAME    blog.sina.com.cn.
blog.sina.com.cn.                        30       IN    CNAME    blogx.sina.com.cn.
blogx.sina.com.cn.                       17       IN    A        49.7.37.126
client.sina.com.                         60       IN    A        66.102.251.24
.......

6.3> dnsmap

dpkg -L dnsmap
#查询系统中与dnsmap相关的文件

dnsmap sina.com -w /usr/share/dnsmap/wordlist_TLAs.txt

root@root:~# dpkg -L dnsmap 
/.
/usr
/usr/share
/usr/share/doc
/usr/share/doc/dnsmap
/usr/share/doc/dnsmap/README.txt.gz
/usr/share/doc/dnsmap/TODO.txt
/usr/share/doc/dnsmap/changelog.gz
/usr/share/doc/dnsmap/use_cases.txt
/usr/share/doc/dnsmap/CREDITS.txt
/usr/share/doc/dnsmap/copyright
/usr/share/doc/dnsmap/changelog.Debian.gz
/usr/share/dnsmap
/usr/share/dnsmap/wordlist_TLAs.txt
/usr/bin
/usr/bin/dnsmap-bulk.sh
/usr/bin/dnsmap
root@root:~# dnsmap sina.com -w /usr/share/dnsmap/wordlist_TLAs.txt
dnsmap 0.30 - DNS Network Mapper by pagvac (gnucitizen.org)
 
[+] searching (sub)domains for sina.com using /usr/share/dnsmap/wordlist_TLAs.txt
[+] using maximum random delay of 10 millisecond(s) between requests
 
ads.sina.com
IP address #1: 111.19.237.230
IP address #2: 111.19.237.226
IP address #3: 111.19.237.229
IP address #4: 111.19.237.231
IP address #5: 111.19.237.228
IP address #6: 111.19.237.227
IP address #7: 111.19.237.233
IP address #8: 111.19.237.232
......

7、DNS注册信息

whois sina.com
#查询sina.com的注册信息

root@kali:~# whois sina.com
   Domain Name: SINA.COM
   Registry Domain ID: 2243615_DOMAIN_COM-VRSN
   Registrar WHOIS Server: whois.paycenter.com.cn
   Registrar URL: http://www.xinnet.com
   Updated Date: 2018-12-20T09:17:25Z
   Creation Date: 1998-09-16T04:00:00Z
   Registry Expiry Date: 2021-09-15T04:00:00Z
   Registrar: Xin Net Technology Corporation
   Registrar IANA ID: 120
   Registrar Abuse Contact Email: supervision@xinnet.com
   Registrar Abuse Contact Phone: +86.1087127926
   Domain Status: serverDeleteProhibited https://icann.org/epp#serverDeleteProhibited
   Domain Status: serverTransferProhibited https://icann.org/epp#serverTransferProhibited
   Domain Status: serverUpdateProhibited https://icann.org/epp#serverUpdateProhibited
   Name Server: NS1.SINA.COM
   Name Server: NS1.SINA.COM.CN
   Name Server: NS2.SINA.COM
   Name Server: NS2.SINA.COM.CN
   Name Server: NS3.SINA.COM
   Name Server: NS3.SINA.COM.CN
   Name Server: NS4.SINA.COM
   DNSSEC: unsigned
   URL of the ICANN Whois Inaccuracy Complaint Form: https://www.icann.org/wicf/
>>> Last update of whois database: 2019-08-13T08:52:42Z <<<

For more information on Whois status codes, please visit https://icann.org/epp

NOTICE: The expiration date displayed in this record is the date the
registrar's sponsorship of the domain name registration in the registry is
currently set to expire. This date does not necessarily reflect the expiration
date of the domain name registrant's agreement with the sponsoring
registrar.  Users may consult the sponsoring registrar's Whois database to
view the registrar's reported date of expiration for this registration.

TERMS OF USE: You are not authorized to access or query our Whois
database through the use of electronic processes that are high-volume and
automated except as reasonably necessary to register domain names or
modify existing registrations; the Data in VeriSign Global Registry
Services' ("VeriSign") Whois database is provided by VeriSign for
information purposes only, and to assist persons in obtaining information
about or related to a domain name registration record. VeriSign does not
guarantee its accuracy. By submitting a Whois query, you agree to abide
by the following terms of use: You agree that you may use this Data only
for lawful purposes and that under no circumstances will you use this Data
to: (1) allow, enable, or otherwise support the transmission of mass
unsolicited, commercial advertising or solicitations via e-mail, telephone,
or facsimile; or (2) enable high volume, automated, electronic processes
that apply to VeriSign (or its computer systems). The compilation,
repackaging, dissemination or other use of this Data is expressly
prohibited without the prior written consent of VeriSign. You agree not to
use electronic processes that are automated and high-volume to access or
query the Whois database except as reasonably necessary to register
domain names or modify existing registrations. VeriSign reserves the right
to restrict your access to the Whois database in its sole discretion to ensure
operational stability.  VeriSign may restrict or terminate your access to the
Whois database for failure to abide by these terms of use. VeriSign
reserves the right to modify these terms at any time.

The Registry database contains ONLY .COM, .NET, .EDU domains and
Registrars.
Domain Name:sina.com
Registry Domain ID:
Registrar WHOIS Server:whois.paycenter.com.cn
Registrar URL:http://www.xinnet.com
Updated Date:2018-09-12T01:18:05.00Z
Creation Date:1998-09-15T20:00:00.00Z
Registrar Registration Expiration Date:2021-09-14T20:00:00.00Z
Registrar:XINNET TECHNOLOGY CORPORATION
Registrar IANA ID:120
Registrar Abuse Contact Email:supervision@xinnet.com
Registrar Abuse Contact Phone:+86.1087128064
Reseller:
Domain Status:
Registry Registrant ID:
Registrant Name:
Registrant Organization:
Registrant Street:
Registrant City:
Registrant State/Province:
Registrant Postal Code:
Registrant Country:
Registrant Phone:
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email:
Registry Admin ID:
Admin Name:
Admin Organization:
Admin Street:
Admin City:
Admin State/Province:
Admin PostalCode:
Admin Country:
Admin Phone:
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email:
Registry Tech ID:
Tech Name:
Tech Organization:
Tech Street:
Tech City:
Tech State/Province:
Tech PostalCode:
Tech Country:
Tech Phone:
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email:
Name Server:ns1.sina.com.cn
Name Server:ns2.sina.com.cn
Name Server:ns3.sina.com.cn
Name Server:ns1.sina.com
Name Server:ns4.sina.com
Name Server:ns3.sina.com
DNSSEC:unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2019-08-13T08:52:51.00Z <<<: 

For more information on Whois status codes, please visit https://icann.org/epp

The Data in Paycenter's WHOIS database is provided by Paycenter
for information purposes, and to assist persons in obtaining
information about or related to a domain name registration record.
Paycenter does not guarantee its accuracy.  By submitting
a WHOIS query, you agree that you will use this Data only
for lawful purposes and that, 
under no circumstances will you use this Data to:
(1) allow, enable, or otherwise support the transmission
of mass unsolicited, commercial advertising or solicitations
via e-mail (spam); or
(2) enable high volume, automated, electronic processes that
apply to Paycenter or its systems.
Paycenter reserves the right to modify these terms at any time.
By submitting this query, you agree to abide by this policy.!!

root@kali:~# 
|  |  |
|--|--|
|  |  |

weixin_45116657

关注

1
点赞
踩
10

收藏

觉得还不错? 一键收藏
0
评论
Kali Linux渗透测试之被动信息收集（一）——nslookup、dig、DNS区域传输，DNS字典爆破，DNS注册信息

一、被动信息收集1、被动信息搜集公开渠道可获得信息；与目标系统不产生直接交互；尽量避免留下痕迹；2、搜集的内容IP地址段，域名信息，邮件地址，文档图片数据，公司地址，公司组织架构、联系电话/传真号码、人员姓名/职务，公开的商业信息等；二、信息收集——DNS1、DNS解析流程：本机的网络配置中会指定一个本地DNS服务器，当发起网络请求时，主机先问本地先问本地DNS服务器，DNS...
复制链接

扫一扫